1. Home
  2. CVE Database
  3. CVE-2018-5223
HIGH · 7.2

CVE-2018-5223

Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permissio...

Vulnerability Description

Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.

CVSS Score

7.2

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
AtlassianFisheye>= 4.4.0, < 4.4.6
AtlassianCrucible>= 4.4.0, < 4.4.6

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2018-5223?

CVE-2018-5223 is a vulnerability with a CVSS score of 7.2 (HIGH). Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permissio...

How severe is CVE-2018-5223?

CVE-2018-5223 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-5223?

Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Fisheye, Atlassian Crucible.